This vulnerability in mf-yang openclaw-cn up to version 0.2.1 involves improper handling of the url argument in the assertBrowserNavigationAllowed function of the Scheme Handler component. This flaw allows an attacker to remotely cause information disclosure by manipulating the url parameter. The vulnerability has been publicly disclosed, and while the project was notified early, no official remediation or patch has been released. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of information due to improper validation or handling of navigation URLs. This could expose sensitive data to remote attackers without requiring user interaction or elevated privileges. The impact is limited to information disclosure with low confidentiality impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded with a fix, users should monitor for official updates or consider implementing temporary mitigations such as restricting or validating input URLs before they reach the vulnerable function. No official fix or workaround is currently available.